diff --git a/kubernetes/README.md b/kubernetes/README.md
index 993689d..2f69505 100644
--- a/kubernetes/README.md
+++ b/kubernetes/README.md
@@ -58,13 +58,13 @@ This section is only relevant to those enrolled in our Google Workspace provisio
 First, you’ll need to edit the file located at `scim-examples/beta/workspace-settings.json`, and fill in the values according to those presented in our Google Workspace documentation.
 
 ```bash
-kubectl create secret generic workspace-settings --from-file=/path/to/workspace-settings.json
+kubectl create secret generic workspace-settings --from-file=workspace-settings=/path/to/workspace-settings.json
 ```
 
 Then, you will need to provide the Google Service Account key file, also generated according to our documentation. Substitute `<keyfile>` with the filename generated by Google for your Google Service Account.
 
 ```bash
-kubectl create secret generic workspace-credentials --from-file=/path/to/<keyfile>.json
+kubectl create secret generic workspace-credentials --from-file=workspace-credentials=/path/to/<keyfile>.json
 ```
 
 ## Deploy to the Kubernetes cluster
diff --git a/kubernetes/op-scim-config.yaml b/kubernetes/op-scim-config.yaml
index 67c40cd..3c104e7 100644
--- a/kubernetes/op-scim-config.yaml
+++ b/kubernetes/op-scim-config.yaml
@@ -15,5 +15,5 @@ data:
   # default: "1pw@[OP_LETSENCRYPT_DOMAIN]"
   #OP_LETSENCRYPT_EMAIL: "1pw@example.com"
   # (Workspace Beta) these settings are specific to those participating in the Google Workspace provisioning beta
-  OP_WORKSPACE_CREDENTIALS: "/secret/workspace-credentials.json"
-  OP_WORKSPACE_SETTINGS: "/secret/workspace-settings.json"
+  OP_WORKSPACE_CREDENTIALS: "/secret/workspace-credentials"
+  OP_WORKSPACE_SETTINGS: "/secret/workspace-settings"
diff --git a/kubernetes/op-scim-deployment.yaml b/kubernetes/op-scim-deployment.yaml
index 0f5f915..39b1da6 100644
--- a/kubernetes/op-scim-deployment.yaml
+++ b/kubernetes/op-scim-deployment.yaml
@@ -36,7 +36,6 @@ spec:
           envFrom:
             - configMapRef:
                 name: op-scim-configmap
-      # TODO: make workspace secrets optional, test deployment with/without workspace secrets
       volumes:
       - name: secrets
         projected:
@@ -45,5 +44,7 @@ spec:
               name: scimsession
           - secret:
               name: workspace-credentials
+              optional: true
           - secret:
               name: workspace-settings  
+              optional: true